open-vault/vault/external_tests/router/router_ext_test.go
Jeff Mitchell 5f7321dcc7 Fix a case where mounts could be duplicated (#6771)
When unmounting, the router entry would be tainted, preventing routing.
However, we would then unmount the router before clearing storage, so if
an error occurred the router would have forgotten the path. For auth
mounts this isn't a problem since they had a secondary check, but
regular mounts didn't (not sure why, but this is true back to at least
0.2.0). This meant you could then create a duplicate mount using the
same path which would then not conflict in the router until postUnseal.

This adds the extra check to regular mounts, and also moves the location
of the router unmount.

This also ensures that on the next router.Mount, tainted is set to the
mount entry's tainted status.

Fixes #6769
2019-06-04 10:33:36 -07:00

68 lines
1.6 KiB
Go

package router
import (
"testing"
"github.com/hashicorp/vault/api"
"github.com/hashicorp/vault/builtin/credential/userpass"
"github.com/hashicorp/vault/builtin/logical/pki"
vaulthttp "github.com/hashicorp/vault/http"
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/vault/vault"
)
func TestRouter_MountSubpath_Checks(t *testing.T) {
testRouter_MountSubpath(t, []string{"a/abcd/123", "abcd/123"})
testRouter_MountSubpath(t, []string{"abcd/123", "a/abcd/123"})
testRouter_MountSubpath(t, []string{"a/abcd/123", "abcd/123"})
}
func testRouter_MountSubpath(t *testing.T, mountPoints []string) {
coreConfig := &vault.CoreConfig{
LogicalBackends: map[string]logical.Factory{
"pki": pki.Factory,
},
CredentialBackends: map[string]logical.Factory{
"userpass": userpass.Factory,
},
}
cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
HandlerFunc: vaulthttp.Handler,
})
cluster.Start()
defer cluster.Cleanup()
vault.TestWaitActive(t, cluster.Cores[0].Core)
client := cluster.Cores[0].Client
// Test auth
authInput := &api.EnableAuthOptions{
Type: "userpass",
}
for _, mp := range mountPoints {
t.Logf("mounting %s", "auth/"+mp)
var err error
err = client.Sys().EnableAuthWithOptions("auth/"+mp, authInput)
if err != nil {
t.Fatalf("err: %v", err)
}
}
// Test secrets
mountInput := &api.MountInput{
Type: "pki",
}
for _, mp := range mountPoints {
t.Logf("mounting %s", "s/"+mp)
var err error
err = client.Sys().Mount("s/"+mp, mountInput)
if err != nil {
t.Fatalf("err: %v", err)
}
}
cluster.EnsureCoresSealed(t)
cluster.UnsealCores(t)
t.Logf("Done: %#v", mountPoints)
}